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(54) Abstract Title 

Network management apparatus and method using an adjustable threshold 

(57) A network management method for use in adjusting a threshold value for a monitored characteristic of a 
managed network comprises comparing one or more values obtained during previous monitoring of the 
characteristic against an adjusted threshold value, and compiling a list of the values which exceed the 
adjusted threshold value. The method creates a list which the network administrator can use during 
adjustment of threshold values. In one embodiment, the method is implemented in the from of a computer 
program. 
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At least one drawing originally filed was informal and the print reproduced here is taken from a later filed formal copy. 
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I 

NETWORK MANAGEMENT APPARATUS AND METHOD 
FOR MONITORING STRESS IN A NETWORK 

The present invention relates generally to an apparatus and method for the 
5 management of a network, and more particularly to a network management apparatus 
and method for monitoring the health or stress of a network. 

The following description is concerned with a data communications network, 
and in particular a local area network (LAN) but has more widespread applicability to 
10 other managed communications systems including wide area networks (WANs) or 
wireless communications systems. 

Networks typically comprise a plurality of computers, peripherals and other 
electronic devices capable of communicating with each other by sending and 

15 receiving data packets in accordance with a predefined network protocol. Each 
computer or other device on the network is connected by a port to the network media, 
which in the case of a LAN network may be coaxial cable, twisted pair cable or fibre 
optic cable. Each device on the network typically has hardware for media access 
control (MAC) with its own unique MAC address. Data packets are sent and received 

20 in accordance with the MAC protocol (e.g. CSMA/CD protocol as defined by the 
standard IEEE $02.2, commonly known as Ethernet). Data packets transmitted using 
the MAC protocol identify the source MAC address (i.e. the MAC address of the 
device sending the data packet) and the destination MAC address (i.e. the MAC 
address of the device for which the data packet is destined) in the header of the data 

25 packet. 

A network is generally configured with core devices having a plurality of 
ports, which can be used to interconnect a plurality of media links on the network. 
Such devices include hubs, routers and switches which pass data packets received at 
30 one port to one or more of its other ports, depending upon the type of device. Such 
core devices can either be managed or unmanaged. 



A managed device is capable of monitoring data packets passing through its 
ports. For example, a managed device can learn, the physical or MAC addresses of 
the, devices connected, to. its ports by monitoring the source address of data packets 
passing through the respective ports- Identified source addresses transmitted from a 
port of a managed network device, such as a router/hub, or switch, are stored in a 
respective * -address table" associated with the: port ~ ; ^ 

Managed devices additionally have the capability of communicating with each 
other using.a management protocol such as the SNMP (Simple Network Management 
Protocol), asndescribed in more detail below. . Whilst the following description is 
concerned with; the SNMP management protocol, the skilled person will appreciate 
JJiat the invention; is not limited to use with SNMP; but can be applied to managed 
networks using oth;er network management protocols. ' r 

: - SNMP^ defines agents, ^managers and MDBs (where MBB is Management ( 
Information Ease), $s well as various* predefined messages and commands for data 
communication. An agent is present in each managed network device and stores 
management; data, responds to requests from.the manager using the GETRESPONSE 
message and may send a TRAP message to; the manager after sensing a predefined 
condition. A manager is present within the network management station- of a network 
and automatically interrogates the agents of managed devices on the network using 
various £NMP commands: such as GET; :and' GETNEXT commands, to obtain 
information suitable for use by the network administrator; whose function is described 
below^ A; MIB is ; a managed " object" database; which . stores rnaiiiagemeait data 
obtained by managed devices, and is accessible to agents for network management - 
applicationso ■■• - . -'uv.:-. f. ^ ;/ 

f SNMP forms part of the TCP/IP protocol i. suite, which is a^nuiiber of 
asspciated protocols developed for networks connected to the Internet also known as 
the World Wide Web : - : : : v - 
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It is becoming increasingly common for an individual, called the network 
administrator, to be responsible for network management; and his or her computer 
system or workstation is typically designated the network management station. The 
network management station incorporates the manager, as defined in the SNMP 
5 . protocol, i.e. the necessary hardware,: and software applications to retrieve data from 
MIBs by sending standard SNMP requests to"the agents dfrhariaged devices on the 
network. 

\ t Network management software applications are kndWri which cm ^determine 

10 the topology of a network, i.e. the ^devices on the network and how they are linked 
s together. In order to determine the network topolojgy, the apjplkJatioh retrieves data 
from the managed devices 'on the network, which, data can prdvide information about 
the devices connected to the managed devices," for 4nstancfe the aforementioned 
"address tables". MIB data can also be retrieved from managed devices to provide 
15 information about: device ; type, device addresses and' details about the links. Using 
. , such data, the apphcation canusuaHy^ entire network. 

^ T : A^ software application 1 capable of 

> detennjwing network topology ds the, Transcend® Network Supervisor application 
20 - available torn 3Com Corporation of Santa Clara, California, USA. 

. A part: of the network administrator's function? is to identify and resolve 
, prpblems Qjc^curring on the network, such as device or link malfunction of failure. In 
r j .order.tQ provide the network administrator wiA^the wecessaiy information to identify 
25 v ^ jsuch problems, the network management application monitors the devices on the 
network. An example of such monitoring is described in co pending UK Patent 
Application No 9917993.9 entitled "Management System and Method for Monitoring 
v j Stress, in. a Network? in the name of the present applicant. In the system and method 
/ described in UK Patent Application No 99 1 7993 . 9 the SNMP manager in the network 
30 management station requests the agents of managed network devices on the network 
device to retrieve selected MIB data indicative of device and link operation, and 



performs tests for device activity and service availability. Such MIB data may relate 
to characteristics such as traffic activity or errors occurring at a particular port in the 
relevant network device. : Tests may, include sending ICMP Ping requests to each 
device on tiie network, or sending selected requests for services such as SMTP, NFS 
and DNS to servers,- an4. monitoring the time taken to receive a response. The 
monitored parameters or phanutferistics are referred to herein; as "stress metrics". 

: Th^ network management application compares,- for : each stress metric, the 
retriey^d data 3 ,or : test results against a corresponding threshold -level for . the stress 

. metric. The , threshold level is the level, -#boye (or below) ; , which performance is 
consjdered.to be unacceptable. For simplicity, the following description is based on a 
maximujn threshold, .that is a threshold level aboye which perfonnance is considered 

,to be unacceptable. TheskiUpd per^n^i^ metrics the 

threshold level could be a level below which performance is unacceptable. Default 
valpe? for.jthreshold leyeds of rnpi?itored„ stress .metrics ^e, typically preset by the 
application vendor, . :r 

. nt Each , time a threshold is exceeded, the .application ..logs an .JSEyent". The 
"Event log" lists each Event, and includes information such as.the date and time of the 
Event, the identity of the device affected and the, nature of the Event. The network 
administrator can then review the Event list to identify problems on the network. 

. It is important, that the threshokfa for the monitored j^ess, metrics are chosen 
so that the number of Eyents presented ,in theJEyrarto^ 
whilst still keeping the network ^adipims^ 

genuine problems on the network for which he is responsible^ It can be difficult for 
the network administrator to choose a threshold level which will be exceeded only if 
genuine problems exist on his particular network. Accordingly, there is a need for a 
system and method . which can be employed by the;, network administrator to assist in 
setting the threshold levels. : ... ,. . . . . ^ 
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In accordance with a first aspect, the present invention provides a method for 
use in adjusting a threshold value for a monitored characteristic of a managed 
network^ the method comprising the steps of: receiving an adjusted threshold value; 
comparing one - or more values obtained during previous monitoring of the 
5 characteristic against the adjusted threshold vkliie; and compiling a list of data relating 
to said values which exceed the adjusted threshold value. ' r ^ ^ 

The present invention thu$ r pfdduces a 'simulated list 5 of past Events which 
would have been previously recorded in an Event log had the threshold been set at the 
10 adjusted threshold 16vel: - This ehatjles' the network administrator to make an informed 
r decision about the adjustment bf thresholds; Advantageously, the setting of the 
threshold level is tailored to sixit^ the operating characteristics of the individual 
' networlTcxmcerned; by Using data generated during previous operation of the network. 

15 ■ In one embodiment,' the method -comprises; adjusting said stress threshold up; 

comparing previously recorded "stress levels obtained during nionitoring of the 
characteristic from an Event log against the adjusted threshold; and storing data for 
those previously recorded stress 1 values which' would have exceeded the adjusted 
y ' threshold in toe list. The method further comprises presenting 1 the list 6f retained 

20 previously recorded stress values foi: review by the network administrator 

In another embodiment, the method comprises: adjusting said stress threshold 
: • down; retrieving historical data from a managed 'network device' on the network, the 
1 historical data relating to 1 ^ess ; levelsr for ffie monitored characteristic; comparing 
25 stress values m ^ and storing data 

- relating *o the stress- Values ^ which exceed the adjusted th[resh6ld. The data is then 

\:,.-ix ; xh accordance with a second aspect; 'the present invdta^ 
30 readable medium carrying a computer program for carrying oiit the ifnethod of the first 
aspect of the present invention. 
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In accordance with a third aspect, the present invention provides a network 
management apparatus for carrying out the method in accordance with the first aspect 
of the present invention. , : 

- Further preferred features and advantages of the present invention will be 
apparent from the following .description and accompanying claims. 

Embodiments of the present invention will now be described, by way of 
example, with reference to the accompanying drawings, in which; 

. Figure 1 .--is,- a ^typical network haying a ; network; management station in 
accordance with the present invention, and ; - i - t :. \ 

^ Figure 2 is a flow chart showing -the ^teps, carried, put by a "computer program 
, in accordance with a pre^ 

, : Figure 1 shows a typical .network,^; management 
system according to a preferred raiboditnent of the present invention.: rThe network 1 
includes, a network nianagement- station 3 A : -which incorporates - the necessary 
hardware and software for network management. In particular, the network 
management station; includes a processor, a memory and a disk drive as well as user 
interfaces such as a keyboard and mouse, and a visual display unit. Network 
management application software in accordance with the present invention is loaded 
into the memory of; msui^j^ in detail 

below. The network management station 3 A: is connected by .; network media links 5 : 
to a plurality of managed network devices, including core devices such as network 
switch 7, hubs 11 and 12, and a router (not shown), which may be . managed or 
unmanaged, and end stations including personal computers 3 and workstations. The 
network may also include unmanaged devices, for example peripheral devices such as 
printers. 
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The network management station 3 A is capable of communicating with the 
managed network devices such as network switch 7 and hubs 1 1 ancl 12 by means of a 
network management protocol, in the present embodiment the SNMP protocol, in 
order to obtain network management data. Each managed device includes a processor 
5 :; which monitors operational characteristics and an SNMP agent which stores the 
monitored data as MIB data in memory on lUie^ device as is Well known m the art, 
including data relating to inter alia data traffic at the device. 

An SNMP managed device may monitor data for' a number :: oF"l&flBs. An 
10 example of a MIB containing network management data is MIB-II (formerly MIB-I) 
as speeified-by the IETF (Internet Engineering Taslc Force) in specification RFC1213. 
MIB-II is common to most vendors' core devices and any he^brk management 
system should preferably be capable of reading and utilising management data from 
MEB-IL Furthermore, the network m&n^ement system of the preferred embodiment 
15 of the present inventidiPis - additionally capable of reading and iitilisirig more complex 
management data contained in such MIBs as RMON (Remote Monitoring MIB, 
^RFC1271), RMON2 (Remote Monitoring MIB 2, RFC2021), the standard bridge 
MEB (RFG T493 ), £ the Standard r^eater MIE( J (RFC 151 6)^ or any prd^rietary MIBs 
' " ' - produced^by original equipment ihaniifa<^ers (eig. the 3Com Remote Poll MlB). 

v erln tifetwork 1, hubs:i l r tod l2 arid- s^ switch 
^ * 7 is also RMON compatible. '" " * r - ^ : : - 

^ present invention, the 

25 a -network management station 3-A m6i^drs : a plurality of stress metrics. The stress 
- r levels or ' values for the metrics ^e ^ requesting relevant MEB- 

L-^M data from luibs >1 1 and 12' and switch 7, and RMON data from switch 7, and by 
periodically polling all rietwbrk devicesriising Ping or Service requests and monitoring 
-* -response tiiiies. s *' c- „ v . v • ■■<. • ^ v...r- 
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The network management station 3A compares each monitored stress level 
against a corresponding predetermined threshold level for the stress metric. Each 
time a threshold is exceeded, the network management station 3A stores details about 
the monitored stress level in an Event log in memory. Monitored stress levels which 
do not exceed the tiireshold are not stored in,the Event log and the received data about 
these, monitored levels . -is,, discarded, or overwritten by subsequent monitored stress 
levels. •■ ■ ■->.••■" ••• -•• -- ;.• - - ■■ 



. A typical Event log, is shown in Table .1 betow.. Each Event listed in the Event 
log -represents a monitored stress kvelwhich exceeded the tbxeshold set for the stress 
metric at the time of ,the Event. ( . . 



Table! 



-Time 


Device Name . 


f Device lype . 


11.06. 


HUB 1 Or 1-72 


FMSII 




S l QQO-1-72 . 


SWITCH 1000 


10.58 


sipqp-i-72 . 


SWITCH 1000 


, 10.58.. 


.PSH40-1-72 


PSHUB40 


10.57 


HUBlO-l-72 


FMSH 


.10.56. 


Sl.000-1-72 


SWITCH 1000 



Description 



Utilisation on port 2 exceeded 80% 
Errors on port 24 exceeded 5% 
Errors on port 2 exceeded 5% 
Broadcasts on port 12 exceeded 200/s 
Utilisation on port 2 exceeded 80% 
Utilisation on port 24 exceeded 80% 



The threshold for each metric is preset in the network management station 3 A 
and ; is adjustable. by ; ^ ,Jhe net^orH administrator 

conventionally has, no m?ap of e^ kve * for 

monitored stress metrics to ensure thaj he or she te informed of all genume Events, Le. 
Events indicative of genuine problems on the netwprk, but is not notified of Events 
which are not significant for the network concerned. 



- In accordance with a preferred embodiment of the present invention, the 
network management ?tatipn 3 A operates a method which uses data obtained during 
previous monitoring,. of the network to simulate an Event log in accordance with one 
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or 'more adjusted thresholds. The network administrator can use the method to try a 
number of different adjusted threshold levels for each stress metric and choose the 
most suitable level which records only genuine Events. : ^ 

5 The method of the " present irivetrtion is preferably" implemented in a computer 

program. In accordance with' the preferred embodiment, the computer program 
carries out the steps illustrated in Figure 2. i : 

The program is initiated by tlie : network administrator (the user) changing a 
10 threshold value, which triggers the jifbgiraih to start at 100 At step 101 the program 
considers whether the threshold has been increased. This -may be done by comparing 
the new threshold value with the original threshold value for the stress metric 
concerned. If the new threshold is greater than the original threshold then the program 
determines that the threshold has increiserf; 1 If the program 101 
15 that the threshold level has Seen increased by the user, the program continues with a 
first program branch according to steps 103 to 108, described in more detail below. If 
step 101 determines that the "threshold level has not been increased, in step 102 the 
program considers whether the threshold has been reduced. If the program determines 
in step 102 that the threshold level has been decreased by the user, the program 
20 continues .with a second program branch according to steps 109 to 116, described in 
more detail below. 

The first program branch is p^formed ill response to an increase in a threshold 
value. This branch uses the bd^g Wg of Everti 
25 application, as described abbve, \6 ^6<iuce "a simulated; new list of past Events, which 
would have beien logged with the increased threshold value. 

At step 103, the program reads the data for the first Event in the existing Event 
log. The first Event is typically the moist recent 1 Event, although the order of Events in 
30 the Event log is dependent on the network maii^i^OTt'appUcation and/or the 
administrator and is not significant in the cbntext of the? present invention. ' The Event 
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data includes the monitored stress value, which exceeded the original threshold and 
triggered the Event, referred to herein as the "Event condition". 

In step 104 the program compares the Event condition against the new 
threshold. In step 105 the program determines whether the Event condition would, 
have generated an Event r if the threshold had been spt at the new threshold. Thus, if 
the stress value causing the Event was . found in step .104 to be greater than or equal to 
the new threshold, in step, 105, the program determines that an Event would have been 
generated, in which case the program stores the Event data in the new Event list at 
step 106 and continues with step 107. If the stress value causing the Event was found 
in step,104 ( to. be less than the new threshold, in step 105, the program determines that 
an Event would not have been generated and goes, straight to step 1 07. 

In step 107, the program considers whether there are any more Events in the 
original Event log. If there exist more Evems in the. Event log, the, program continues 
by reading the next Eyent at step 1 08. „ -The progron continues with steps. 1 04 to 1 07, 
until step -107 determines that no more Events exist. The program then continues with 
step 120 by presenting the new Event list. The^ program then en$s : . _ 

The second program , branch, is performed in .response, to a decrease in a 
threshold value. This branch .uses both, the existing log of Events of the network 
management application, as described ^ove, and itu^er retrieved management data 
to produce a simulm^ new r Ust . of Ey^ logged, with the 

reduced threshold value. ^il:;- -;r r - !l 

, In. step 109, the program determines the . managed network device which is 
nearest to the device or link being monitored by the metric, and, which stores suitable 
historical data for the metric. The managed network device r may : be a specialised 
monitoring device or .may be a core managed network -device such as a hujb px switch. 
In the preferred embodiment, the historical data is monitored and stpred by an 
"RMON probe", as is well known in the art, and is made available by it through the 
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RMON etherHistory MIB table. It will be appreciated that other management probes 
may be used for the same purpose. Accordingly, in thte preferred embodiment, the 
program determines in step 109 the nearest RMON probe to the device or link 
monitored by the metric. This is achieved using knowledge of the detwork topology. 

Once the nearest RMON probe has been drtermined; in step 1 TO "the program 
reads the etherHistory table from the RMON probe. Thd table is rfead by retrieving 
rows of the table using the? GET or GETNEXT SNMP commands. : r 

10 Having retneVed the* tkbk, thfe program TOiitinues-it step 111 by reading the 

first roW in the tablfe which included the stress values) ' for tfie v ' stress metric, as 
monitored by the RMOltf-'probe;* ^ ^ " ; x V ■ ■ *' ' ^ ■ 

:i 1 In Step 112 the progi^ compares ^ 

15 of the first tablfe row witfr the neW threshold; Ih step 113 the progr^deterinines 
whether the history value would h^ hiad been set 

ait idle new threshold. Thus, if the History Value \vas found in step 112 to lie greater 
than or equal to tfae iieW threshold^ in stejr 1 13, the program de*emiihes that an Event 
would have been generated, in which case the program at step 1 14 generates an Event 
20 based on the history value, and "stores this Event in the ne\tf, simulated Event list, 
" which includes a copy Events from the existing Event log and continues 

v : with st^pTl i& ( If T the hi^diy^ Valued was found in step x l 12* td^be iess ] than the new 
r tto^hbld; ih "Sep i : i3; -^e v piragpfsm- determines -'that: -fch -Event' 5 would not have been 
generated and goes straight to step 115. 

25 

- v f; ^ jjj stejp 1 i5, the program considers whether there are any more rows in the 
:l:L ' ii::;t i^^B : tabl^.' , If more rows exist, the program continues by reading the riebrt row in the 
51 ai table at step 116: The program continues with steps 112 to 115 until step 115 
' 'deterininefc that ho more table rows exist. The program -then cbntiAues rr with ; step 120 
30 ! by prWen^g the hew Event list. The program then rads ' vr r * i rv ? ; . 



12 



It will be appreciated that program steps 101 and 102 may be included in a 
single step and the program could be initiated by the program automatically selecting 
adjusted threshold values. Furthermore, it will be appreciated that to produce the new 
Event list using the first branch, the existing Event log could be copied and Events 
5 removed from the Event log if step. 105 determines that the Eyent would not have 
> been generated. In that xase, step 106 would not be employed. 

Various modifications may be made to the described embodiments. It is 
intended to include all such modifications and changes which fall within the scope of 
10 T the present invention as defined in the accompanying claims. 
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CLAIMS : 

1. ■ A method for use in adjusting a threshold value for a monitored characteristic 
of a managed network, the method comprising the steps of: receiving an adjusted 
threshold value for the monitored characteristic; comparing one or more values 
obtained during r previous monitoring of the? characteristic against the iadjusted 
threshold value, and compiling a list of data relating to said values which exceed the 
adjusted threshold value. , : 

2. A method as claimed in ^ wherein the monitored characteristic is 
indicative of the performance of the network or a part thereof and the threshold value 
is a value above which performance is deemed to be unacceptable. 

3. A method as claimed in claim 1 or claim 2, wherein the one or more values 
obtained during previous monitoring are values which exceeded an unadjusted 
threshold value previously stored in memory. 

4. A method as claimed in claim 3, wherein the step of adjusting comprises 
increasing the threshold value. 

5. A method as claimed in claim 3 or claim 4, wherein the step of comparing 
comprises reading each of said one or more values in turn, and comparing each value 
with the adjusted threshold value. 

6. A method as claimed in claim 5, wherein the step of compiling comprises 
storing data relating to each of said one or more values which exceed the adjusted 
threshold value as the list. 

7. A method as claimed in claim 5, wherein the step of compiling comprises 
copying the one or more values from memory into said list, and removing from the 
list each of said one or more values which do not exceed the adjusted threshold. 
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8. A method as claimed in claim 1 or claim 2, wherein the one or more values 
obtained during the previous monitoring are historical values stored by a managed 
device on the network. , ; 

9. A method as claimed in any one of claim 8, wherein the step of adjusting 
comprises decreasing the, threshold value. 

10. A method as claimed in claim 8 or claim 9, wherein the step of comparing 
comprises reading each of said one or more values in turn, and comparing each value 
with the adjusted threshold value. 

11. A method as claimed in claim 8, 9 or 10, wherein, before the step of 
comparing, the method comprises retrieving said historical values stored by said 
managed network device on the network. 

12. A method as claimed in claim ^1 1, wherdn, before the step of retrieving, the 
method comprises determining the managed device containing historical values for 
the, monitored cluu^tf eristic which is nearest to the part of the network being 
monitored using knowledge of the topology of the network. 

13. A method as claimed in claim 1 1 or claim 12, wherein the historical values are 
stored in SNMP MBBs and are retrieved using SNMP commands. 

14 A method as claimed in claim 13, wherein the managed network device is an 
RMON probe and the historical values are stored in the RMON etherHistory table. 

>. i;i ..- ' ■ ; •:./?•• 

15. A method as claimed in any one of claims 8 to 14, wherein the step of 

compiling comprises storing data relating to each of said one or more values which 

exceed the adjusted threshold in said list. 
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16. A method as claimed in claim 15, wherein the step of compiling further 
comprises retrieving data relating to values obtained during previous monitoring 
which exceeded an unadjusted threshold value from memory, and storing said data in 
the list. 

17. A method as claimed in any preceding claim wherein the ci'ata relating to said 
values comprises information including one or more of: the time the value was 
monitored; the monitored device; the monitored characteristic, and the monitored 
value. 

18. A method as claimed in any preceding claim, further comprising presenting 
said compiled list to a user. 

19. A method for use in adjusting a threshold value for a monitored characteristic 
of a managed network substantially as hereinbefore described with reference to, and 
as shown, Figure 2 of the accompanying drawings. 

20. A computer readable medium including a computer program for carrying out 
the method as claimed in any one oF claims 1 to 19. 

21. Apparatus for use in adjusting a threshold value for a monitored characteristic 
of a managed network, the apparatus comprising^ means "for receiving an adjusted 
threshold value for a monitored characteristic; means for comparing one or more 
values obtained during previous monitoring of the characteristic against the adjusted 
threshold value, and means for compiling a list of said one or more values which 
exceed the adjusted threshold value. 
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